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METHOD FOR MONITORING THE PERFORMANCE RELIABILITY 
OF A CONTROL UNIT AND DIAGNOSTIC DEVICE 



Field Of The Invention 

The present invention relates to a method for monitoring the performance reliability of a 
control unit and/or at least one sensor of a safety device for the protection of vehicle 
occupants, as well as a diagnostic device. 

5 Background Information 

Safety devices for the protection of vehicle occupants such as front and side airbags, rollover 
bars, belt tighteners etc., are standard equipment in motor vehicles manufactured these days. 
Typically, such safety devices are made up of a multitude of sensors for detecting a crash by 
recording a crash-related negative acceleration or velocity, and a control unit for the safety 
10 device, which analyzes a value derived from the crash. If a specific threshold value, which 
points to the presence of a crash, is detected, the control unit triggers the corresponding 
restraining means. 

As is often the case in electronic devices, there is the risk in control units and/or in sensors as 
well that they will not fimction or will not fiinction properly, Which, however, must be 
15 avoided under all circumstances when safety devices are involved. Modem safety devices for 
the protection of vehicle occupants therefore include devices for checking the correct 
functioning of the sensors and/or the control unit, thereby detecting a malfimction as early as 
possible. 

For the most reliable operation of a safety device in a motor vehicle it is of crucial 
20 importance that the crash sensors (such as acceleration sensors, deformation sensors) and the 
corresponding control unit operate without faults at all times. If the performance reliability of 
a crash sensor or a control unit is intermpted, this must be signaled immediately so that the 
required repair and exchange may be initiated. 

Safety-relevant electronic devices to which the life of vehicle occupants is entrusted in a 
25 dangerous situation, must have extraordinary performance reliability. In most cases such high 
performance reliability can be guaranteed only if all components of the safety device are able 
to be checked with respect to their functioning. 



NYOi 1047782 vi SUBSTITUTE SPECIFICATION 



In the method -for checking an acceleration sensor of the safety device, a test signal is applied 
to the particular acceleration sensor whose proper functioning is to be tested. The answer 
signal transmitted by the acceleration sensor in response to the test signal will then be utilized 
as a measure for ascertaining the functioning of the acceleration sensor. These function tests 
5 of the acceleration sensor are carried out continuously during normal operation of the safety 
device, for instance when starting the vehicle. 

As far as the general background of the test for correct functioning of acceleration sensors is 
concerned, reference is made to the laid-open documents German Published Patent 
Application No. 44 39 886, German Published Patent Application No. 37 06 765, German 
10 Published Patent Application No, 37 36 294, German Published Patent Application No. 43 02 
399, German Published Patent Application No. 197 57 1 18 as well as the German patent 
document German Patent No. 32 49 367. 

In control units for safety devices for the protection of vehicle occupants and their remote 
sensors there is also always the risk that they get damaged in a crash. This type of damage 

15 depends mostly on the severity of the impact. If the impact, and thus the deformation, is 
severe enough to deform the location at which the control unit or the appropriate sensors is 
affixed, the impact may have damaged the control unit and/or the sensors as well. Such 
damage may be so severe that the control unit or the sensors are no longer operable. In this 
case these devices would have to be exchanged. Despite an impact and a resulting 

20 deformation it is entirely possible, however, that the control unit and individual sensors are 

still working properly, so that there is no need to replace them. Furthermore, it is possible that 
the control device or the sensors have indeed been damaged slightly by the impact, but in the 
beginning are still fully functional nevertheless. However, there is the risk in this case that 
these devices lose their functionality over the course of time, for instance due to mechanical 

25 influences such as vibrations, temperature or the entry of moisture, or stop functioning in 
another accident. In this case these devices should have been exchanged after the original 
impact. 

However, it is very difficult to distinguish the mentioned scenarios from each other. In 
particular in the case of a still operative devices it is not easy without further measures to 
30 determine whether and when this unit will possibly malfunction. 



NYOl 1047782 vl 



SUBSTITUTE SPECIF 



In control unites for safety devices, in particular in the case of airbag control units, these are 
therefore exchanged, typically after one to five crashes during v^hich the control unit has 
triggered at least one restraining means. In the case of crash sensors, there are often no 
regulations whether and, if so, under what circumstances these should be exchanged in the 
5 event of a crash. 

A related problem also arises fi-om the fact that, especially in service facilities with less 
experienced staff, all control units and crash sensors are often exchanged because of a crash 
although some of them are still working perfectly. As an altemative, there is also the 
possibility that, for instance, a fiiUy fimctioning control unit is exchanged, whereas an 
10 acceleration sensor, for example, which no longer provides fiiU operability, is not replaced. 

Summary Of The Invention 

The principle on which the present invention is based is that the control unit or a comparable 
device decides on its own whether the control unit should be exchanged in the aftermath of a 
crash. In addition or as an altemative, the control unit or a comparable device may also 
15 decide whether and, if so, which sensors should be exchanged in the event of a crash. This 
minimizes the repair costs resulting fi-om a crash since only control units or sensors that are 
not fiiUy fimctional are replaced, whereas the operative devices may continue to be used. This 
also minimizes the risk of a control unit or a sensor failing in a crash. 

An additional advantage of the method according to the present invention is that this 
20 fiinctionality must be described in the corresponding manuals and system specifications of 
the vehicle manufacturer, the service facility testing devices and vehicle manuals, which 
leads to high transparency and ensures excellent verifiability of the method. 

In one very advantageous embodiment a value for the impact severity is calculated not only 
for each control unit but for each sensor as well, this value being calculated in a device- 

25 specific manner. The individually calculated value for the impact severity of the control unit 
or sensor in question will then be compared to a predefined threshold value. As a rule this 
threshold value is also predefined specifically for the individual control imit or the individual 
sensor. This means that, depending on the location of the individual control unit or the sensor 
inside the motor vehicle, and depending on its mechanical properties, a threshold value 

30 adapted thereto may be predefined in each case. Furthermore, the threshold value naturally 

may also depend on other parameters such as the mechanical stability of the particular device. 
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In a fuFther advantageous refinement, information from several preceding impacts is also able 
to be taken into consideration when determining the value for the impact severity of the 
control unit. In particular, this functionality provides, for instance, that preceding impacts in 
which the control unit has triggered will be taken into accoimt as well when determining the 
5 impact severity of a new impact. As a result, a detected renewed impact may be assigned a 
relatively higher value for the impact severity than an equally heavy impact which was not 
preceded by an earlier impact, this being accomplished by scaling with a correction factor, for 
instance. As an alternative, it is also conceivable that the predefined threshold value is 
lowered in a repeat impact. In an advantageous manner, this refinement according to the 
10 present invention thus takes the possibility into account that the control unit has sustained 
damage in an earlier impact already. 

In another advantageous embodiment, the absolute value of the predefined threshold value is 
lowered with increasing operating time of the safety device. This takes the fact into 
consideration that, with increasing operating time, the control unit or the sensors no longer 
15 work as well compared to their original state, for instance, even without impact and thus 
without resulting damage, due to external influences, such as vibrations, temperature 
influences, improper handling etc. 

One advantageous refinement uses measurements fi:om crash tests and calculations and 
findings derived therefi-om to determine the predefined threshold value. Vehicle 

20 manufacturers are able to define for each model variant how high the predefined threshold 
should be selected as a fijnction of the particular velocity, vehicle impact, impact type etc. 
For instance, prior to the initial operation of a safety device in a motor vehicle, a multitude of 
crash tests must be carried out to test this safety device. Such crash tests then yield empirical 
values or other findings for the predefined threshold at which the corresponding sensors and 

25 control units do stay operative after a crash, but it turns out ultimately that the performance 
reliability can no longer be ensured in long-term testing. 

In an advantageous refinement, a testing device of a service center reads out and analyzes the 
output function-error signal. In addition or as an alternative, this may also be done by the 
control unit itself. 

30 In the latter case the diagnostic device will require an output unit, which informs the vehicle 
user of an occurring error signal. This output unit may be realized in the form of a blinking 
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light, fer instance. Furthermore, it may of course also be provided in the functionality of an 
onboard computer installed in the motor vehicle. In an advantageous refinement it is possible 
to infer from the error signal which control unit or which sensor is no longer fully 
functioning. 

In a very advantageous embodiment, the functionality of the diagnostic device may be 
implemented in the control imit itself, either entirely or at least partially. In the event that the 
measured or calculated value for the impact severity exceeds the predefined threshold value, 
the diagnostic device emits a function-error signal either to a service station testing device or 
to a program-controlled unit. In an advantageous manner a control-unit-typical or sensor- 
typical threshold value is provided for this control unit or for each sensor. This predefined 
threshold value is lower than a threshold value specified for the triggering of a restraining 
means. 

Brief Description Of The Drawings 

Figure 1 shows a block diagram of a safety device in a motor vehicle having the diagnostic 
device according to the present invention. 

Figure 2 shows a sequence of a method according to the present invention, on the basis of a 
block diagram. 

Figure 3 shows a block diagram of a second embodiment of a diagnostic device according to 
the present invention. 

Detailed Description 

Unless specifically mentioned otherwise, identical or functionally equivalent elements have 
been provided with matching reference numerals in the figures of the drawing. 

Figure 1 shows the block diagram of a safety device having the diagnostic device according 
to the present invention. 

Reference numeral 1 in Figure 1 denotes the safety device. Here, safety device 1 is embodied 
as electronic restraining means, such as an airbag system. The safety device includes an 
airbag control unit 2 as well as a multitude of sensors 3 to 5. In the case at hand, safety device 
1 has one or more front sensors 3 and side sensors 4, 5 although it is also possible to provide 
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rear sensors as^well. The present invention includes a diagnostic device 6. Diagnostic device 
6 communicates bidirectionally, both with control unit 2 and sensors 3 to 5. hastead of a 
single diagnostic device 6 it would also be conceivable, of coxirse, to provide each control 
imit 2 or each sensor 3 to 5 with its own diagnostic device 6. It would likewise be possible to 
5 implement the functionality of diagnostic device 6 into control unit 2. 

Diagnostic device 6 according to the present invention includes a comparator 7 as well as an 
output unit 8. 

In the following, the method according to the present invention is described in greater detail 
on the basis of the block diagram in Figure 2. 

10 A vehicle impact typically produces an acceleration (or velocity or pressure) in the x- and y- 
direction. Should a vehicle impact occur, these accelerations are detected by at least one of 
sensors 3 to 5. These accelerations in the x-direction and y-direction are each integrated into a 
velocity (degraded vehicle velocity DV), and a mean value is generated therefrom. This so- 
called degraded velocity DV or its mean value usually is used as measure for the impact 

15 severity. 

The installed and remote sensors 3 through 5 thus supply control unit 2 with information 
regarding their mechanical loading (pressure or acceleration) as a result of a vehicle impact. 
During the vehicle impact, control unit 2 ascertains the respective integral and peak values of 
the measured signals. The data thus obtained are competed to adjustable thresholds, which 
20 ultimately leads to a triggering of a restraining means. 

Furthermore, according to the present invention the degraded vehicle velocity, which is 
calculated from the maximum of the calculated x, y integrals of the measured acceleration, is 
utilized as a measure of the crash severity. These values for the crash severity are stored, for 
instance in a maximum amount memory. Following a vehicle impact, the content of the 

25 maximum-amount memory may be compared to a threshold specified by the vehicle 
manufacturer, which was determined in crash tests, for instance, which are conducted 
anyway. This comparison is implemented in comparator 7. If the predefined threshold is 
exceeded, control unit 2 or diagnostic device 6 will generate an error signal, which is 
indicated to the vehicle user in the form of a warning light 8, for example. In addition or as an 

30 altemative, this error-function signal may also be read out in a service facility by a service- 
facility testing device. Therefore, if a function-error signal is output, this indicates that airbag 
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control' unit 2 and/or the respective sensors 3 to 5 must be exchanged. If the maximum 
amount remains below the predefined threshold, and if control unit 2 or sensors 3 to 5 exhibit 
no faults in an intemal self-test, the individual device may remain in the vehicle since it is 
considered fully functional. 

Li this way vehicle manufacturers are able to define a threshold (such as DV = 30 km/h) at 
which control unit 2 should be replaced. Either in addition or as an alternative, each 
individual external sensor 3 to 5 may be tested using similar calculations, either in addition or 
as an altemative. Airbag control unit 2 may therefore decide for itself and for each remote 
sensor 3 through 5 whether a replacement is warranted after a vehicle impact. 

Although the present invention has been described above on the basis of the aforementioned 
preferred exemplary embodiment, it is not limited thereto, but may be modified in various 
ways. 

For instance, as illustrated in the exemplary embodiment in Figure 3, diagnostic device 6 
according to the present invention may also be implemented in control unit 2. Furthermore, 
comparator 7 and/or output unit 8 need not necessarily be included in diagnostic device 6, but 
may also be installed at some other location in the vehicle. 

Finally, the present invention is not limited to the number of control units 2 or sensors 3 to 5 
shown in Figures 1 and 3, but may be expanded to any number of such devices 2 to 5. 
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